Cable modems provide broadband services over cable networks by communicating with a Cable Modem Termination System (CMTS, or “head-end”). Cable modems are located in end users' premises.
Cable networks generally authenticate cable modems to ensure, in part, that an end user using a cable modem is a paying customer. FIG. 1 shows a conventional cable modem Base Line Interface Plus (BPI+) authentication scheme used in Data Over Cable Service Interface Specification (DOCSIS) systems.
Referring to FIG. 1, a Cable Modem (CM) 4 located in cable network 2 uses the Baseline Privacy Key Management (BPKM) protocol to send an Authorization Request 6 that includes the cable modem's identity attribute 5. The identity attribute 5 is based on an X.509 certificate and a concatenation of a Media Access Control (MAC) address, a serial number, a manufacturer identification and an Rivest Shamir Adleman (RSA) public key for the cable modem 4. The Authorization Request 6 may be sent after registration of the cable modem 14.
After receiving the authorization request 6, a CMTS 3 authenticates the cable modem 4 by validating the X.509 certificate in the identity attribute 5 using a certificate chain provisioned in the local memory of the CMTS. When the cable modem 4 is authorized for cable service, the CMTS 3 uses the BPKM protocol to send back an Authorization Reply 8 that includes a locally generated Authorization Key 7. Lifetime information and ciphersuite information for the Authorization Key 7 are included in the Authorization Reply 8.
The BPI+ authentication scheme shown in FIG. 1 has limitations. For example, the cable modem 4 does not authenticate the CMTS 3, meaning that a cable modem user is vulnerable to a fraudulent network device. Also, BPI+ does not allow the authentication of cable modems to be centralized for the cable network. In other words, all CMTSs include local resources to locally authenticate downstream cable modems. Also, when authentication of the cable modem occurs after registration of the cable modem, the cable modem authentication is vulnerable to a security exploit that involves modifying the cable modem's configuration value. Moreover, the sequence of authentication exchanges is predefined, non-negotiable and otherwise fixed in BPI+. For these and other reasons, an improved remote and extensible authentication system for cable networks is needed as cable networks increase in size.